EU Cyber Resilience Act
Since 11 September 2026 you have to report actively exploited vulnerabilities in your products within 24 hours. From 11 December 2027 every product with digital elements you place on the EU market has to meet Annex I. This page is for teams building industrial products on Cortex-M microcontrollers.
The dates
Products that ship in December 2027 are being designed now. These are the dates that apply to a product with firmware, sold in the EU:
Who does what
Most of the CRA is process. Some of it can only be done in the firmware, and that part is hard to add late, because it starts at the first instruction the device runs.
Annex I, clause by clause
Annex I lists the essential requirements. This table shows each one that touches firmware, what Groundplane does for it, and the status on each supported microcontroller. "In part" means some of it works today and the rest is on the roadmap. Whether a clause applies to your product is decided by your risk assessment.
| Annex I | What it asks | What Groundplane provides | STM32U5 | STM32C5 |
|---|---|---|---|---|
| Part I (2)(a) | No known exploitable vulnerabilities at release | About a dozen dependencies, each pinned to one version. Sanitizers, compile-fail tests and fault-injection tests in the test suite. Vulnerabilities in Groundplane handled under a published policy. | In part | In part |
| Part I (2)(b) | Secure by default, with a reset to the original state | No unsigned or single-signature mode exists to switch on by mistake. Factory reset that wipes settings and user data: planned. | In part | In part |
| Part I (2)(c) | Vulnerabilities can be fixed with security updates | The device side: signed update, trial boot and automatic rollback. Delivering the update and notifying users stays with your system. | Works today | Works today |
| Part I (2)(d) | Protection from unauthorised access | Signatures checked on every boot and every update. Locked bootloader: planned. STM32U5: readout and write protection, boot lock, OEM keys and TrustZone isolation. STM32C5: readout and write protection, boot lock, OEM keys and hide protection. The STM32C5 has no TrustZone. | In part | In part |
| Part I (2)(e) | Confidentiality of stored and transmitted data | Firmware image encryption with the microcontroller's AES hardware: planned. Your risk assessment decides whether you need it, and has to say why if you don't. | Planned | Planned |
| Part I (2)(f) | Integrity of programs and configuration, and reporting corruption | Every image signed with ECDSA P-256 and ML-DSA-65; both are checked on every boot. An update package is checked before any flash is erased. Settings carry a CRC and a generation, and corruption is counted. | Works today | Works today |
| Part I (2)(h) | Essential functions stay available, also after an incident | A new image gets up to three counted trial boots with the watchdog running, then the device reverts to the previous one. Recovery over UART when nothing can boot. | Works today | Works today |
| Part I (2)(j) | Limited attack surface | A 45 KB bootloader without an RTOS. Fuzzing the USB update protocol and restricting it to a fixed schema: planned. | In part | In part |
| Part I (2)(k) | Exploitation mitigation | Memory protection unit set up at startup, stack limits, traps on unaligned access and division by zero, signing hardened against fault attacks. STM32U5: TrustZone isolation, planned. STM32C5: no TrustZone; memory protection unit only. | In part | In part |
| Part I (2)(l) | Record and monitor internal activity | Crash reports with a backtrace that survive the watchdog reset, counters for rejected and reverted updates, a record of every boot decision. A security event log with an opt-out: planned. | In part | In part |
| Part I (2)(m) | Remove all data and settings | Factory reset: planned. | Planned | Planned |
| Part II (1) | A software bill of materials | Generated by the build, in CycloneDX: planned. The dependency list is short enough to read in a minute. | Planned | Planned |
| Part II (2), (8) | Fix vulnerabilities without delay; security updates free of charge | Fixes ship in the latest release, free for every licensee until the published end date of their release line. A security counter separate from the version number, so a security fix doesn't force new features on you. | Works today | Works today |
| Part II (3) | Effective and regular security testing | Hundreds of automated tests on the host, in emulation and on the board, including fault injection on the bootloader. The tests ship with the source and run on your board. | Works today | Works today |
| Part II (4)–(6) | Disclosure policy, contact address, published advisories | For Groundplane itself: security page, security.txt and an advisory list. | Works today | Works today |
| Part II (7) | Secure distribution of updates | Images are signed in the build. A key-handling procedure for your production keys, and key revocation in OTP memory: planned. | In part | In part |
Points (g) and (i), data minimisation and impact on other networks, depend on what your product does and stay with you. Status as of 1 November 2026.
Readiness, not a stamp
Nobody can make your product compliant for you. You are the manufacturer of your product: the risk assessment, the technical file and the declaration of conformity are yours.
What I can do is implement the clauses above in the firmware, show you the tests that prove it, and give you the evidence for your file. That moves work off your schedule. It doesn't move any obligation off your books.
A bootloader is a "boot manager", an important product in class I of Annex III. Volt Software is Groundplane's manufacturer, with its own vulnerability handling, a declared support period and, by 1 November 2027, a submission for class I conformity assessment.
Next step
Groundplane pilot
Three months on an STM32U5 or STM32C5, with written success criteria and the product-line licence when it succeeds. For the first five customers; the list price is EUR 20,000.
How the pilot worksA call
Tell me what your product is and when it ships. I'll tell you whether Groundplane fits, and if it doesn't, I'll say so.
Get in touchThis page is an engineering reading of the regulation, not legal advice. It is based on:
Tell me which microcontroller your product uses and when it ships. I'll tell you which of these clauses Groundplane covers for it, and which stay with you.